Filter
Top Products
66
McAfee
®
Host Intrusion Prevention 6.1 Product Guide IPS Policies
Search IPS Exception Rules
4
Search IPS Exception Rules
You can search for exceptions in any IPS Rules policy on the Search IPS Exception Rules
tab. This search function enables you to determine if an exception is required for a
signature rule. It also enables you to manage exceptions by deleting duplicate
exception rules or creating trusted applications to allow a blocked process. Search
criteria include the processes that triggered an event, the signatures that caused the
event to be triggered, and the users affected by the exception rule. After you have
found the related exception rules you are searching for, you are advised to manage this
list to keep the number of overall exceptions to a minimum. You can do this by deleting
ones that are not needed because exceptions already exist for a particular processes
or signature, or by duplicating and editing an exception to replace several similar
exceptions. The
Search IPS Exceptions tab also enables you to disable exceptions instead
of permanently deleting them, and to find exceptions that match a profile to copy to
other IPS policies.
To search for exceptions and manage the list of exceptions:
1 On the
Search IPS Exception Rules tab, click Search.
The Search IPS Exception Rules dialog box appears.
2 Select the appropriate criteria and do one of the following:
select All (the default) for all processes.
select Specific and click Edit to indicate specific processes. In the Search for Specific
[Criteria]
dialog box, move items from the available list to the selected list and click
OK.
Figure 4-21 Search IPS Exception Rules